If a cyberattack hits your business, the first hour is the one that matters most.
It’s also the easiest time to make things worse — by turning off the wrong machine, deleting evidence, or replying from an email account the attacker is already reading. The steps below tell you exactly what to do, in order, so you’re not guessing in the moment. No technical knowledge required.
Before Anything Else: Don't Make It Worse
Before you touch anything, avoid these common mistakes:
- Don’t power off the affected computer
If you can help it. Disconnecting it from the network is better — shutting it down can wipe evidence stored in memory that your IT team and investigators will need. - Don’t delete anything.
Leave the ransom note, the suspicious email and any alerts exactly where they are. - Don’t pay a ransom on the spot.
This is a decision that needs to be made calmly, with expert support — not in the first panicked hour. - Don’t use hacked email or accounts to discuss the attack.
If an attacker is in your inbox, they can read those messages. Switch to phone calls or a separate account.
The Step-by-Step Plan
Work through these in order, starting the moment you notice something’s wrong.
1. Disconnect the Affected Devices from the Network
Unplug the network cable and turn off Wi-Fi on anything that appears affected. This stops the problem spreading to other computers and to your backups.
CISA‘s guidance is to isolate devices rather than power them off where possible, and only shut a device down if you can’t get it off the network any other way.
2. Call Your IT Provider — By Phone
Don’t email. If the attacker is watching your inbox, you’re tipping them off. Call your IT provider directly.
Here at iQtec, we manage cyber controls day to day, provide continuous oversight, and respond quickly to emerging threats or incidents, acting as a single point of coordination when issues arise. If you’re a client, call us on our direct support line straight away.
If you have cyber insurance, call them next — many policies require you to involve their incident team early.
3. Leave the Evidence Alone
Don’t wipe, reinstall or tidy up the affected machines. Screenshots of the ransom note or suspicious emails are useful, but keep the originals too.
4. If Money Was Sent, Call Your Bank Immediately
Ask them to recall the transfer and freeze it if possible. With wire and bank fraud, acting in the first few hours makes the biggest difference.
5. Reset Passwords from a Clean Device and Enable Multi-Factor Authentication
Start with email and admin accounts. Use a device you know is unaffected.
6. Report the Attack
Reporting can help with recovery, and it’s sometimes legally required. Where you report depends on your country:
- Australia: Report through ReportCyber or call the 24/7 hotline on 1300 CYBER1.
- United States: File with the FBI’s Internet Crime Complaint Center (IC3) and report to CISA.
- United Kingdom: Report through the NCSC and to Action Fraud.
Where Notification Obligations Come In
If personal data about customers or staff was exposed, you may be legally required to notify a regulator and the affected individuals — sometimes within 72 hours.
The rules depend on where you operate:
- Australia: Notifiable Data Breaches (NDB) scheme under the Privacy Act
- UK and Europe: GDPR
- United States: State breach-notification laws
Expert review note: Notification obligations are a legal matter. Speak with your legal adviser or IT provider early so you don’t miss a reporting deadline.
Should You Pay the Ransom?
If it’s ransomware, this will likely be your biggest question. The FBI does not recommend paying.
Paying doesn’t guarantee you get your files back. It marks you as a business that pays, and the money funds further attacks. Sometimes a free decryption tool already exists for the exact ransomware variant that hit you, which is one more reason to get the experts involved before paying anyone anything.
This is a decision to make with law enforcement, your IT or incident-response team, and your insurer — not alone.
The Best Time to Prepare Is Before It Happens
All of this is far easier if you've made some of these decisions in advance. You don't need a thick binder — just a simple one-page plan that covers:
Who to call first — your IT provider and insurer, with numbers you can reach without your main systems.
Where your backups are - and proof they've been tested by restoring from them.
Which accounts and devices matter most - so you know what to protect first.
At iQtec, we help organisations move from reactive security controls to a structured, intelligence-led approach that protects systems, data and people. A plan doesn't need to be complex — it just needs to exist before you need it.
Ready to Build a Response Plan Before You Need One?
If you would like to understand your current cyber risk, discuss framework alignment, or explore whether managed cyber security is right for your organisation, Get in touch and speak with the iQtec team today.
FAQs
What's the first thing to do in a cyberattack?
Disconnect the affected devices from the network by unplugging the network cable and turning off Wi-Fi, then call your IT provider by phone. Getting the device off the network stops the problem spreading while you get expert help.
Should I turn off the computer if I get ransomware?
If you can, disconnect it from the network rather than powering it off. Shutting it down can wipe evidence stored in memory. Only power a device off if you can’t get it off the network any other way.
Should I pay the ransom?
The FBI does not recommend it. Paying doesn’t guarantee you get your data back, and it funds more attacks. Make that decision with law enforcement, your IT or incident-response team, and your insurer — and check whether a free decryption tool already exists first.
We wired money to a scammer. What do we do?
Call your bank immediately and ask them to recall the transfer. In Australia, report to ReportCyber and your bank’s fraud team. In the US, report to the FBI’s IC3 within 72 hours — their Recovery Asset Team recovers funds in a high proportion of cases reported quickly.
Who do I report a cyberattack to?
In Australia: ReportCyber or 1300 CYBER1. In the US: FBI IC3 and CISA. In the UK: NCSC and Action Fraud. Also notify your cyber insurer, and check whether you have a legal duty to notify a regulator if personal data was exposed.